GHSA-g3gf-mwj7-2hc4HighCVSS 7.1
Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically...
🔗 CVE IDs covered (1)
📋 Description
Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-79786
- https://github.com/coroot/coroot/issues/929
- https://github.com/coroot/coroot
- https://github.com/coroot/coroot/blob/v1.24.5/api/mcp_oauth.go
- https://www.vulncheck.com/advisories/coroot-1.20.2-through-1.24.5-unvalidated-redirect-uri-in-mcp-oauth-client-registration
- https://github.com/advisories/GHSA-g3gf-mwj7-2hc4